Mobile IP is a protocol that enables a mobile host to roam from one access network to another without loss of IP connectivity. In Mobile IP, a special entity referred to as a home agent, is deployed on the Internet to track the location of mobile computers (hosts) and to route IP packets to them irrespective of their physical locations. A mobile host owns a fixed IP address that belongs to the subnet of the home agent. Any application programs running on the mobile host use this fixed IP address as the source IP address during network communications. Whenever the mobile computer attaches to a subnet, a care-of IP address belonging to the subnet is reported to the home agent, so that the home agent can route inbound IP packets to the mobile host's current location using an IP tunnel. If a foreign agent is deployed on the subnet, the foreign agent's IP address is the mobile's care-of IP address. If there is no foreign agent, the mobile must have a built-in foreign agent, and it needs to apply an IP address from the subnet for this built-in foreign agent.
All IP packets destined for the mobile host are intercepted by the home agent when they arrive at the home agent's subnet. The home agent encapsulates these packets into new IP packets with the home agent's IP address as source IP address and the care-of IP address as destination IP address. When they arrive at the foreign agent, the encapsulated packets are decapsulated, and the inner IP packets are delivered to the TCP/IP stack of the mobile host. IP packets that are communicated from the mobile host to a destination host are encapsulated into new IP packets by the foreign agent. The outer source IP address is the care-of IP address, and the outer destination IP address is the home agent's IP address.
Due to security concerns and the insufficiency of IPv4 address, many Internet Service Providers (ISPs) and corporate networks use NAT/NAPT technologies in their firewall gateways. This makes mobility management very difficult because it affects the conventional update signaling of care-of IP addressing. According to current methods, either the mobile host cannot securely update its own care-of IP address that is behind the firewall with its mobility router outside of firewall, or complicated signaling methods are needed to coordinate communications between the mobile host, the firewall gateway, and the mobility router. Neither is a satisfactory solution. Accordingly, there exists a need for a new in-band signaling method for mobility management, which assures secure updates of care-of IP addresses across a firewall and which does not require coordination with the firewall. In accordance with an aspect of the invention, there is provided an in-band signaling method that employs encrypted three-way handshake signaling messages that are embedded in encapsulated IP packets to enable care-of IP address updates. This method can effectively protect mobile hosts from denial-of-service attacks and is transparent to NAT/NAPT firewalls. The signaling messages are communicated between the home agent and the mobile host, in a manner transparent to any NAT/NAPT firewall in the network.